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A. INTRODUCTION 

1. Pursuant to Article 23 of the Protocol on the Statute of the Court of 
Justice of the European Union, the United Kingdom submits these 
Written Observations to the Court. 

2. The case arises out of a reference for preliminary ruling made by the 
High Court of Ireland (‘the Referring Court’) on 17 July 2014, regarding 
the interpretation of Article 25(6) of Directive 95/46/EC of the European 
Parliament and of the Council of 24 October 1995 on the protection of 
individuals with regard to the processing of personal data and the free 
movement of such data (‘the Directive’). 

3. In the national proceedings, the Applicant, a user of the social 
networking website, Facebook, seeks to challenge a decision of the 
Irish Data Protection Commissioner (‘the Commissioner’), the official 
whose office serves as the supervisory authority in Ireland for the 
purposes of Article 28 of the Directive, regarding Facebook’s transfer of 
subscribers’ data to servers located in the United States. The Applicant 
alleged that US law and practice did not ensure an adequate level of 
protection for the data, and that such transfers were therefore contrary 
to Article 25(1) of the Directive. The Commissioner rejected the 
Applicant’s complaint partly on the basis of the European 
Commission’s decision 2000/520/EC of 26 July 2000 (‘the Decision’) 
pursuant to Article 25(6) of the Directive, finding that the US does 
ensure an adequate level of data protection. 

4. The Referring Court underlines that the Applicant does not purport to 
challenge the validity either of Article 25(6) of the Directive or of 
Commission decision 2000/520/EC: see paragraph 20 of the Order for 
Reference. The Referring Court specifically rejected as inappropriate 
an attempt by an intervener to expand the scope of the proceedings so 
as to include such a challenge: see paragraphs 28-29 of the Order for 
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Reference. The Referring Court’s question expressly reflects those 
conclusions. 

5. Instead, the Referring Court’s question is one of interpretation: see 
paragraph 26 of the Order for Reference. The Referring Court 
essentially wishes to know whether the Directive should be interpreted, 
in the light of Articles 7, 8 and 47 of the EU Charter of Fundamental 
Rights (‘the Charter’), as permitting or requiring supervisory authorities 
in the Member States to override a decision of the Commission 
pursuant to Article 25(6) of the Directive finding that a third country 
ensures an adequate level of data protection. 

6. For the reasons set out below, the United Kingdom submits that 
supervisory authorities may not override a Commission decision 
pursuant to Article 25(6) in this manner. In summary: 

a. The meaning of Article 25(6) is clear: Member States are 
required to comply with a decision of the Commission under that 
provision. No role or power is given to Member States or 
particular national bodies such as supervisory authorities. Any 
other interpretation would be contra legem ; 

b. The meaning of the Decision is equally clear. The Commission 
has found that an adequate level of data protection applies in 
the case of data transfers to the US by organisations self- 
certifying their compliance with the US Department of 
Commerce’s Safe Harbor Privacy Principles, as set out in Annex 
I of the Decision; and that in implementing the Decision Member 
States’ only powers are to suspend such data flows in limited, 
specified circumstances, which are not alleged to apply in the 
present case. 
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B. ANALYSIS 

The meaning of Article 25(6) of the Directive 

7. The second unnumbered sub-paragraph of Article 25(6) of the 
Directive provides that ‘Member States shall take all the measures 
necessary to comply with’ a decision of the Commission made 
pursuant to the first unnumbered sub-paragraph of Article 25(6). The 
text of the provision therefore makes clear that Member States must 
act in accordance with, and may not depart from, the Commission’s 
decision. 

8. That interpretation of Article 25(6) is confirmed having regard to the 
objectives of the Directive: 

a. The Directive aims to ensure equivalent protection for the rights 
and freedoms of individuals across the Union with regard to the 
processing of their data: see recital (8) in the Preamble of the 
Directive. The Commission’s power to adopt decisions under 
Article 25(6) is one of the means by which such a common 
approach is guaranteed. If Member States were free to 
disregard the Commission’s assessment and to substitute their 
own views as to the adequacy of data protection in third 
countries, the protection afforded to data processing rights 
would vary from country to country, undermining the 
transparency and confidence that are needed to underpin the 
free flow of data within the Union; 

b. The Directive also aims to provide a stable and effective 
platform for the cross-border flows of personal data between the 
Union and third countries that are a necessary component for 
the expansion of international trade: see recital (56) of the 
Directive. The provision in Article 25(6) for the Commission to 
adopt binding decisions serves to ensure the Union’s ability to 
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maintain a united front on the international stage, thereby 
enabling it to secure appropriate terms of trade in negotiations 
with third countries, including as regards data protection. 

9. The meaning of Article 25(6) of the Directive is therefore clear and 
straightforward. It cannot be interpreted in such a way as to permit or 
require the authorities of the Member States to override a Commission 
decision taken pursuant to it. Any such interpretation would be 
contrary to the clear meaning of and purposes pursued by that 
provision, and would be contra legem. The Commission’s power to 
assess the adequacy of the level of data protection acts as a protection 
of the rights of data subjects in the Union, as enshrined in the Charter. 

The meaning of Decision 2000/520/EC 

10. Given that, as above, the Directive provides no role for Member States 
or supervisory authorities to review a Decision made under Article 
26(5) the only other place such a role might conceivably be provided 
for is in the Decision itself. 

11. However on that point the interpretation of Decision 2000/520/EC is 
equally clear: 

a. Article 1(1) embodies the Commission’s finding that the US 
Department of Commerce’s Safe Harbor Privacy Principles (‘the 
Principles’), implemented in accordance with guidance provided 
by the accompanying ‘frequently asked questions’ document, 
ensures an adequate level of protection for personal data 
transferred from the EU to organisations established in the US. 1 
The level of protection provided by those Principles is 
substantially similar to that conferred within the Union by the 
Directive and the national legislation which implements it; 


1 The Commission conducted a review of the Decision in 2013/14 and concluded that it 
continued to ensure adequate protection in the case of data transfers to the US. 
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b. Article 1(2) and (3) provide that organisations receiving data 
must certify their adherence to the Principles and notify their 
commitment to the US Department of Commerce in order for a 
data transfer to them to fall within the scope of the Decision (a 
procedure known as ‘self-certification’); 

c. Article 3 specifies the circumstances in which Member States 
may exercise their powers to suspend data flows to the US, 
namely: 

i. where a government body in the United States finds that 
the Principles are being violated; or 

ii. where the Member State considers, independently of any 
such finding, that there is a substantial likelihood that the 
Principles are being violated; there is a reasonable basis 
for believing that the enforcement mechanism is not 
suitable to deal with the case in an adequate and timely 
fashion; and where the competent authorities in the 
Member State concerned have made reasonable efforts 
to give notice to the organisation in question and an 
opportunity to respond; 

d. Member States therefore retain the power to act in 
circumstances where such action is necessary to protect the 
rights of EU citizens as enshrined in the Charter. It is not 
alleged that the circumstances identified in Article 3 are of any 
application in the present case. 

12. The Referring Court appears to accept that the effect of the Decision, if 
binding, is that the Irish supervisory authority was right to reject Mr. 
Schrems’ complaint. The Referring Court does not itself propose any 
interpretation of the Decision whereby that conclusion could be 
avoided. 
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C. CONCLUSION 

13. For the reasons set out above, the United Kingdom respectfully 
submits that the Court should answer the question referred as follows: 


Where the Commission has adopted a decision pursuant to Article 
25(6) of Directive 95/46/EC of the European Parliament and of the 
Council of 24 October 1995 on the protection of individuals with regard 
to the processing of personal data and the free movement of such 
data, finding that a third country ensures an adequate level of 
protection the second unnumbered sub-paragraph of Article 25(6) must 
be interpreted as requiring the supervisory authorities of the Member 
States to comply with the terms of that decision. 
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